iomap_dio_bio_iter() falls through to the sub-block tail zeroing when the data bio submission fails, so that the rest of the block is still zeroed and stale data is not exposed. The zeroing result is assigned to ret, which overwrites the submission error with the successful zeroing result (zero) and the failed write is reported as success. Store the zeroing result separately and only use it when the data path did not already fail. Fixes: 10553a91652d9 ("iomap: fix iomap_dio_zero() for fs bs > system page size") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Andrea Parri --- fs/iomap/direct-io.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/fs/iomap/direct-io.c b/fs/iomap/direct-io.c index 8b4039d16ce89..8ae3fe64e475c 100644 --- a/fs/iomap/direct-io.c +++ b/fs/iomap/direct-io.c @@ -581,9 +581,14 @@ static int iomap_dio_bio_iter(struct iomap_iter *iter, struct iomap_dio *dio) ((dio->flags & IOMAP_DIO_WRITE) && pos >= i_size_read(inode))) { /* zero out from the end of the write to the end of the block */ pad = pos & (fs_block_size - 1); - if (pad) - ret = iomap_dio_zero(iter, dio, pos, - fs_block_size - pad); + if (pad) { + ssize_t zerror; + + zerror = iomap_dio_zero(iter, dio, pos, + fs_block_size - pad); + if (!ret) + ret = zerror; + } } out: /* Undo iter limitation to current extent */ -- 2.53.0